You have two methods in the API: addUsersToRoles() and setUserRoles().
As they are both in the API documentation, they are both recommended and they both work.
There is no point in getting “the feeling that this is not the correct way”

(And by the way, a Mongo update( { $set: ... } ) is atomic [definition] up to the document level, so saying that “this will remove the existing user role” is not correct. Before the set operation the user will have one role, and after he will have two. There is no state between these two.)